26.7.1: Migration Assistant exports 0-byte firewall rules CSV and omits legacy disabled rules

[djBassman]

**

download_rules.csv

download_rules.csv.zip

**
Hi,

Please see issues below.

Important notices

• I have read the contributing guidelines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue
• AI tools were used to create at least part of the text submitted herewith.

Model used:

ChatGPT (OpenAI GPT-5.5)

Extent of AI involvement:

AI was used to help organize the investigation, summarise the collected evidence, and format this bug report. All testing, command output, screenshots, observations and verification were performed by me.

---

Describe the bug

After upgrading an existing OPNsense installation that uses legacy firewall rules to OPNsense 26.7.1, the new Firewall Rules migration process does not function correctly.

The Migration Assistant correctly detects my legacy firewall rules, however:

• Export current rules downloads a 0-byte download_rules.csv.
• The new Firewall → Rules page does not display all legacy rules. At least one disabled rule present in /conf/config.xml is missing from the Rules page.
• The legacy firewall itself continues to operate correctly.

Because the exported CSV is empty, it is not safe to continue with the migration.

---

To Reproduce

1. Upgrade an existing installation using legacy firewall rules to OPNsense 26.7.1.
2. Open Firewall → Migration Assistant.
3. Observe that legacy firewall rules are detected (47 rules in my case).
4. Click Export current rules.
5. The browser downloads download_rules.csv.
6. Inspect the downloaded file.

Result

The downloaded file is:

download_rules.csv

File size:

0 bytes

Contents:

(empty)

Additional observation:

1. Open Firewall → Rules.
2. Compare the displayed legacy rules with /conf/config.xml.
3. Observe that at least one disabled rule is missing from the Rules page despite existing in the configuration.

---

Expected behaviour

The Migration Assistant should export every detected legacy firewall rule into a valid CSV suitable for import.

The Firewall → Rules page should display every detected legacy firewall rule, including disabled rules.

---

Actual behaviour

The Migration Assistant reports:

Export current rules (47)

However:

• download_rules.csv is 0 bytes
• The CSV contains no header
• The CSV contains no rules
• At least one disabled legacy firewall rule is not shown in the new Rules page.

---

Describe alternatives you considered

Before reporting this issue I performed the following troubleshooting:

• Upgraded from 26.7.0 to 26.7.1
• Cleared browser cache
• Hard refresh (Ctrl + F5)
• Tested with Firefox
• Tested with Chromium
• Verified legacy firewall rules still exist in /conf/config.xml
• Verified rule count
• Verified disabled rule count
• Compared missing rule against XML
• Checked configd logs during export

The behaviour remained unchanged.

---

Screenshots

(Attached)

• Migration Assistant
• Firewall → Rules page
• Empty download_rules.csv
• Missing disabled rule
• Browser screenshots (if useful)

---

Relevant log files

No relevant errors were observed during the export.

The configd logs show no migration/export related activity when the CSV export is performed.

---

Rule count verification

grep -c "<rule uuid=" /conf/config.xml

Output:

47

---

Disabled rule count

grep -c "<disabled>1</disabled>" /conf/config.xml

Output:

9

---

Example missing rule

The following disabled rule exists in /conf/config.xml but is not displayed by the new Firewall → Rules page.

UUID:
2c772765-4c1e-4c61-9f34-0b7926bbf8db

Description:
VM_PlexFileServer_Mint_210_212 Internet Full Access Rule

Relevant XML:

<rule uuid="2c772765-4c1e-4c61-9f34-0b7926bbf8db">
    <type>pass</type>
    <interface>opt8</interface>
    <ipprotocol>inet46</ipprotocol>
    <statetype>keep state</statetype>
    <descr>VM_PlexFileServer_Mint_210_212 Internet Full Access Rule</descr>
    <direction>in</direction>
    <quick>1</quick>
    <protocol>tcp/udp</protocol>
    <source>
        <address>VM_PlexFileServer_Mint_210_212</address>
    </source>
    <destination>
        <address>Internet_Only_Invert_Dst</address>
        <not>1</not>
    </destination>
    <log>1</log>
    <disabled>1</disabled>
</rule>

Nothing about this rule appears unusual.

---

Additional context

The Migration Assistant correctly detects 47 legacy firewall rules.

The legacy firewall configuration appears intact.

The firewall continues operating normally using the legacy rule set.

The downloaded CSV is always 0 bytes, preventing safe migration.

Because of this, I have not attempted to:

• Import the empty CSV.
• Remove the legacy firewall rules.

I did not want to risk losing the existing firewall configuration.

---

Environment

Software

OPNsense 26.7.1-amd64

Hardware

AMD GX-420CA SOC with Radeon™ HD Graphics

Network Interfaces

4 × Broadcom NetXtreme BCM5719 Gigabit Ethernet PCIe (bge0–bge3)

1 × Realtek RTL8111/8168/8211 PCI Express Gigabit Ethernet Controller (re0)

Browsers tested

• Firefox
• Chromium

Both browsers produce identical behaviour.

---

Attachments

• Migration Assistant screenshots
• Firewall → Rules screenshots
• Empty download_rules.csv
• Relevant /conf/config.xml excerpts
• Configuration backup (available if required)

---

Thank you,
Anthony.

[Monviech]

What does this command return:

configctl filter list legacy_rules

if you get no output you can also try the script directly, to see if there's any errors:

/usr/local/opnsense/scripts/filter/list_legacy_rules.php

[djBassman]

legacy_rules.txt

Hi Monviech,

Please see the attached txt file with the output of both commands which look identical.

Thank you.

[Monviech]

I've tested it with your payload

The csv download worked for me. It might be an issue with a browser extension I assume?

[fichtner]

Can you check the console for errors?

# opnsense-log php

If there's 47 rules and the file is empty PHP could have crashed.

[djBassman]

I tried the requested command:

root@OS-FW:~ # opnsense-log php
No corresponding log 'php' was found.

I also checked the available log types:

root@OS-FW:~ # opnsense-log -l
audit
configd
ddclient
dhcpd
dnsmasq
filter
firewall
hostwatch
lighttpd
ntpd
openvpn
pkg
resolver
system
wireguard

It doesn't appear that a php log is available via opnsense-log on my installation.

I also noticed that 26.7.1_1 is now available as an update.

Would you prefer that I:

remain on 26.7.1 while this issue is being investigated, or
update to 26.7.1_1 and retest the migration export?

[fichtner]

Yeah ok no PHP problem then.

[zachwingrave]

This may be an unrelated problem but I had an issue where only 1 of my exported rules was being imported again. I noticed it was the only rule where the description parameter contained quotation marks " ". After removing the quotation marks from the download_rules.csv file manually, the import worked.

[nsoderberg]

Confirming this on 26.7 (commit 8215982), so it isn't something introduced in 26.7.1.

Environment

• OPNsense 26.7, upgraded (not a fresh install)
• 22 legacy filter rules in config.xml, 4 of them disabled
• 4 NAT port forwards

Symptom
Identical to the report: "Export rules to CSV" in the migration assistant downloads a
0-byte file — no header row, no rules. Legacy rules were all present and working in
config.xml at the time.

Worth noting for severity: on this version the legacy firewall_rules.php pages are
gone (the URL 404s), so legacy rules are visible only as read-only entries in
Rules [new] with no per-rule delete. With the export broken there is no supported
migration path at all — the only options are hand-rebuilding every rule in the new
interface, or editing config.xml offline.

A possible lead, untested: 9 of my 22 legacy filter rules carried
associated-rule-id values (nat_…) pointing at NAT port forwards whose own
associated-rule-id field was empty — the association appears to have broken
one-directionally when the NAT page moved to MVC. If the exporter dereferences that
association while building rows, a dangling lookup on the first such rule would explain
an empty file with no header. Speculation, but it may be cheap to rule out.

I proceeded to do the migration manually since I didn't have that many rules.

[djBassman]

Thanks for the additional information.

I can confirm that I have now successfully migrated my firewall rules.

On my second migration attempt:

• All 47 firewall rules were imported.
• All 9 disabled rules were retained correctly.
• I can now enable/disable the migrated rules from the new Rules interface.
• I can edit the migrated rules successfully.
• I checked the backend/general logs and found no relevant firewall or PHP errors.
• The migrated rules are being loaded into pf correctly.

I am currently leaving the legacy rules in place while I validate the new rules under normal operation before removing the legacy rules.

So at this point, I can no longer reproduce the original migration problem on my installation.

This is interesting compared with the other reports of the CSV remaining 0 bytes. In my case the migration is now working, although I wasn't able to determine exactly what changed between the failed and successful attempts.

I'm running Version 26.7.1 at this time until I have verified all firewall rules are working correctly and I have removed all legacy rules and retested firewall operation again.

Thanks for looking into it.